Win32.GhostSec.zip
- SHA256 90a2d935dcd1ea5a18ffb8194f9a8893ca2f62c9deaccbc8c94855b770387ea2
Password
infected
Behavioral task
behavioral1
Sample
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Win32.GhostSec.zip
- Size 7.8MB
- Sample240422-yzpy2aff71
- SHA256 90a2d935dcd1ea5a18ffb8194f9a8893ca2f62c9deaccbc8c94855b770387ea2
- MD5 fc111eb72cd394a0dc6c785f321745ad
- SHA1 5223db383114366949a1eaf3a25db69cde5c528a
- SHA512 c790890f715332db9f4b37c1ab9b3011c5f7ef338af55b966b00bd096bbe1a2c0acfe35f7b8a7cecaa1b7c03a6fad16c435bd5348b5f20798f76f6c4ecfafdaf
- SSDEEP 196608:xI+eYXW7cupNAYIP7z7LpMHPLlGn5ymyp0fdcgAEZ:xU8eFcfT/ivhMymVcV+
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
ghostlocker
C2
-
http://94.103.91.246/addInfection
-
http://94.103.91.246/incrementLaunch
Signatures
- Ghostlocker family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9 unpack001/a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
File Explorer
-
Win32.GhostSec.zip.zip 7.8MB
-
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9.exe 7.0MB
-
a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f.exe 7.0MB
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
- IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
- SHA256 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
- MD5 8ad67a1b7a5f2428c93f7a13a398e39c
- SHA1 d4f71fc5479a02c8ff57c90fc67b948adb5604e0
- SHA512 57475600b531b3b80936bf3015d5a38bba61cfac793cb4de9985d4e4b0afdc12f7f591ecdc8e9f9fd2dcb7b0e3d2fe851f33f80ba2888730774f73ac8ab34b5c
- SSDEEP 98304:UNmXStQHQu1OCUPExButIaUgF246UZ0R+xp2exp2U3KQ5KntG:2Bt2Qu1OAxW2kyRU913KQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
426624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
205KB
Virtual Size
573KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
405KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
86KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
706KB
Virtual Size
706KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
534KB
Virtual Size
534KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
151KB
Virtual Size
150KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
318KB
Virtual Size
318KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
- IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
- SHA256 a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
- MD5 f001329114937fbc439f251c803ba825
- SHA1 95ae81de52655fac3f1b226f1896690566090640
- SHA512 2148b2d2aa3c5d70cb975a31b3026fa618b633122f1b953e4a0efe5c03e86058f63161fad0fb4f5dbebcf3f9634b5fd89b98200c6158c125b03abf42d6c04d26
- SSDEEP 98304:nc73qiu3g8TIvjESButfoF+6UGzzFBLzA2PP8e:cmh3g8TI4SnCGVBL02P0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
426624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
205KB
Virtual Size
573KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
168B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
/4
Size
512B
Virtual Size
297B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/19
Size
404KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/32
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/46
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/65
Size
705KB
Virtual Size
705KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/78
Size
531KB
Virtual Size
531KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/90
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
317KB
Virtual Size
317KB
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ